Getting Data In

TA-Exchange-2013-ClientAccess inputs.conf/throttling-counters search macro mismatch

edonze
Path Finder

The object= line in the inputs.conf for TA-Exchange-2013-ClientAccess doesn't match the throttling-counters search macro. See below:

[perfmon://MSExchange_Throttling]
index=perfmon
object=MSExchange User Throttling
instances=*
counters=*
interval=30
disabled=false

throttling-counters macro:

object="MSExchange Throttling"

Tags (2)
0 Karma
1 Solution

edonze
Path Finder

Changed the macro to:

( object="MSExchange Throttling" OR object="MSExchange User Throttling" )

I'm not sure if the more correct fix would have been to update the inputs.conf in the TA, but this made the Client Access Servers dashboard work.

View solution in original post

0 Karma

edonze
Path Finder

Changed the macro to:

( object="MSExchange Throttling" OR object="MSExchange User Throttling" )

I'm not sure if the more correct fix would have been to update the inputs.conf in the TA, but this made the Client Access Servers dashboard work.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...